No OS can maintain a device beyond 'mothership' support.

They can provide a limited subset of security patches however once OEMs stop supporting devices firmware/driver updates then it is inevitable that they will remain insecure beyond then.

GrapheneOS provides harm reduction extended support releases where resources allow, usually up to the following major Android release beyond where OEM support ceases.

This is not full GrapheneOS and is ideally only to be used to provide transition time to a supported/recommended device or for people to flash on older hardware to get a taste/play around with the OS to see if it works for them on a daily driver production device.